PraisonAI Call Server Unauthenticated Agent Access (CVE-2026-47396)

union CommonSecurityLog, W3CIISLog, AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("/agents", "/invoke", "/delete") or csUriStem has_any ("/agents", "/invoke", "/delete")
| where RequestMethod in ("GET", "POST", "DELETE") or csMethod in ("GET", "POST", "DELETE")
| where isempty(RequestHeader_Authorization) or not(RequestHeader_Authorization matches regex @"Bearer .+")
| extend SourceIP = coalesce(SourceIP, cIP)
| extend TargetURL = coalesce(RequestURL, csUriStem)
| project TimeGenerated, SourceIP, TargetURL, RequestMethod, csMethod, ResponseCode, csStatus
| summarize RequestCount = count(), Methods = make_set(coalesce(RequestMethod, csMethod)), StatusCodes = make_set(coalesce(tostring(ResponseCode), tostring(csStatus))) by SourceIP, bin(TimeGenerated, 5m)
| where RequestCount > 2
| order by RequestCount desc

index=web OR index=proxy sourcetype IN ("access_combined", "iis", "nginx:access", "apache:access")
| where (uri_path="/agents*" OR uri_path="/invoke*" OR uri_path="/delete*")
| eval has_auth=if(like(lower(http_request_header), "%authorization: bearer%"), "yes", "no")
| where has_auth="no"
| eval http_method=coalesce(http_method, method)
| stats count AS request_count, values(http_method) AS methods, values(status) AS status_codes, dc(uri_path) AS unique_endpoints BY src_ip, span("5m") _time
| where request_count > 2
| eval risk_score=case(request_count > 20, "critical", request_count > 10, "high", request_count > 5, "medium", true(), "low")
| table _time, src_ip, request_count, methods, status_codes, unique_endpoints, risk_score
| sort - request_count

sequence by source.ip with maxspan=5m
  [network where event.dataset in ("nginx.access", "apache.access", "iis.access") and
   url.path : ("/agents*", "/invoke*", "/delete*") and
   not (http.request.headers.authorization : "Bearer *")]
  [network where event.dataset in ("nginx.access", "apache.access", "iis.access") and
   url.path : ("/agents*", "/invoke*", "/delete*") and
   not (http.request.headers.authorization : "Bearer *")]

SELECT sourceip, "URL", "Method", "Response Code", COUNT(*) AS request_count
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Microsoft IIS')
AND ("URL" ILIKE '/agents%' OR "URL" ILIKE '/invoke%' OR "URL" ILIKE '/delete%')
AND ("Authorization Header" IS NULL OR "Authorization Header" NOT ILIKE 'Bearer %')
AND DATETIME > NOW() - 1 HOURS
GROUP BY sourceip, "URL", "Method", "Response Code"
HAVING COUNT(*) > 2
ORDER BY request_count DESC
LAST 60 MINUTES

_sourceCategory=web/access OR _sourceCategory=proxy/logs
| where (url matches "/agents*" or url matches "/invoke*" or url matches "/delete*")
| where !(authorization matches "Bearer *")
| timeslice 5m
| count by _timeslice, src_ip, url, method, status_code
| where _count > 2
| sort by _count desc
| fields _timeslice, src_ip, url, method, status_code, _count

rule cve_2026_47396_praisonai_unauth_agent_access {
  meta:
    author = "df00tech"
    description = "Detects unauthenticated access to PraisonAI call server agent endpoints (CVE-2026-47396)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-86qc-r5v2-v6x6"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method in ["GET", "POST", "DELETE"]
    re.regex($e.network.http.target_url, `/agents|/invoke|/delete`)
    not re.regex($e.network.http.request_headers["authorization"], `(?i)bearer .+`)
    $ip = $e.principal.ip

  match:
    $ip over 5m

  condition:
    #e > 2
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkReceiveAcceptIP4
| CommandLine = /praisonai|call_server|uvicorn/
| RemotePort in (8000, 8080, 8090, 5000)
| groupBy([RemoteAddressIP4, LocalAddressIP4, RemotePort], function=count())
| rename RemoteAddressIP4 as source_ip, LocalAddressIP4 as dest_ip
| where count > 2
| sort count desc